Examples with RefreshableKeycloakSecurityContext org.keycloak.adapters.RefreshableKeycloakSecurityContext used on opensource projects

Example 21 with RefreshableKeycloakSecurityContext

use of org.keycloak.adapters.RefreshableKeycloakSecurityContext in project keycloak by keycloak.

the class OIDCFilterSessionStore method isCached.

@Override
public boolean isCached(RequestAuthenticator authenticator) {
    HttpSession httpSession = request.getSession(false);
    if (httpSession == null)
        return false;
    SerializableKeycloakAccount account = (SerializableKeycloakAccount) httpSession.getAttribute(KeycloakAccount.class.getName());
    if (account == null) {
        return false;
    }
    log.fine("remote logged in already. Establish state from session");
    RefreshableKeycloakSecurityContext securityContext = account.getKeycloakSecurityContext();
    if (!deployment.getRealm().equals(securityContext.getRealm())) {
        log.fine("Account from cookie is from a different realm than for the request.");
        cleanSession(httpSession);
        return false;
    }
    if (idMapper != null && !idMapper.hasSession(httpSession.getId())) {
        log.fine("idMapper does not have session: " + httpSession.getId());
        // System.err.println("idMapper does not have session: " + httpSession.getId());
        cleanSession(httpSession);
        return false;
    }
    securityContext.setCurrentRequestInfo(deployment, this);
    request.setAttribute(KeycloakSecurityContext.class.getName(), securityContext);
    needRequestRestore = restoreRequest();
    return true;
}

Example 22 with RefreshableKeycloakSecurityContext

use of org.keycloak.adapters.RefreshableKeycloakSecurityContext in project keycloak by keycloak.

the class OIDCFilterSessionStore method checkCurrentToken.

@Override
public void checkCurrentToken() {
    HttpSession httpSession = request.getSession(false);
    if (httpSession == null)
        return;
    SerializableKeycloakAccount account = (SerializableKeycloakAccount) httpSession.getAttribute(KeycloakAccount.class.getName());
    if (account == null) {
        return;
    }
    RefreshableKeycloakSecurityContext session = account.getKeycloakSecurityContext();
    if (session == null)
        return;
    // just in case session got serialized
    if (session.getDeployment() == null)
        session.setCurrentRequestInfo(deployment, this);
    if (session.isActive() && !session.getDeployment().isAlwaysRefreshToken())
        return;
    // FYI: A refresh requires same scope, so same roles will be set.  Otherwise, refresh will fail and token will
    // not be updated
    boolean success = session.refreshExpiredToken(false);
    if (success && session.isActive())
        return;
    // Refresh failed, so user is already logged out from keycloak. Cleanup and expire our session
    // log.fine("Cleanup and expire session " + httpSession.getId() + " after failed refresh");
    cleanSession(httpSession);
    httpSession.invalidate();
}

Example 23 with RefreshableKeycloakSecurityContext

use of org.keycloak.adapters.RefreshableKeycloakSecurityContext in project keycloak by keycloak.

the class SpringSecurityCookieTokenStore method checkPrincipalFromCookie.

/**
 * Verify if we already have authenticated and active principal in cookie. Perform refresh if
 * it's not active
 *
 * @return valid principal
 */
private KeycloakPrincipal<RefreshableKeycloakSecurityContext> checkPrincipalFromCookie() {
    KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = CookieTokenStore.getPrincipalFromCookie(deployment, facade, this);
    if (principal == null) {
        logger.debug("Account was not in cookie or was invalid");
        return null;
    }
    RefreshableKeycloakSecurityContext session = principal.getKeycloakSecurityContext();
    if (session.isActive() && !session.getDeployment().isAlwaysRefreshToken())
        return principal;
    boolean success = session.refreshExpiredToken(false);
    if (success && session.isActive()) {
        refreshCallback(session);
        return principal;
    }
    logger.debug("Cleanup and expire cookie for user {} after failed refresh", principal.getName());
    CookieTokenStore.removeCookie(deployment, facade);
    return null;
}

Example 24 with RefreshableKeycloakSecurityContext

use of org.keycloak.adapters.RefreshableKeycloakSecurityContext in project keycloak by keycloak.

the class SpringSecurityRequestAuthenticator method completeBearerAuthentication.

@Override
protected void completeBearerAuthentication(KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal, String method) {
    RefreshableKeycloakSecurityContext securityContext = principal.getKeycloakSecurityContext();
    Set<String> roles = AdapterUtils.getRolesFromSecurityContext(securityContext);
    final KeycloakAccount account = new SimpleKeycloakAccount(principal, roles, securityContext);
    logger.debug("Completing bearer authentication. Bearer roles: {} ", roles);
    SecurityContext context = SecurityContextHolder.createEmptyContext();
    context.setAuthentication(new KeycloakAuthenticationToken(account, false));
    SecurityContextHolder.setContext(context);
    request.setAttribute(KeycloakSecurityContext.class.getName(), securityContext);
}

Example 25 with RefreshableKeycloakSecurityContext

use of org.keycloak.adapters.RefreshableKeycloakSecurityContext in project keycloak by keycloak.

the class JaxrsBearerTokenFilterImpl method propagateSecurityContext.

protected void propagateSecurityContext(JaxrsHttpFacade facade, ContainerRequestContext request, KeycloakDeployment resolvedDeployment, BearerTokenRequestAuthenticator bearer) {
    RefreshableKeycloakSecurityContext skSession = new RefreshableKeycloakSecurityContext(resolvedDeployment, null, bearer.getTokenString(), bearer.getToken(), null, null, null);
    // Not needed to do resteasy specifics as KeycloakSecurityContext can be always retrieved from SecurityContext by typecast SecurityContext.getUserPrincipal to KeycloakPrincipal
    // ResteasyProviderFactory.pushContext(KeycloakSecurityContext.class, skSession);
    facade.setSecurityContext(skSession);
    String principalName = AdapterUtils.getPrincipalName(resolvedDeployment, bearer.getToken());
    final KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = new KeycloakPrincipal<RefreshableKeycloakSecurityContext>(principalName, skSession);
    SecurityContext anonymousSecurityContext = getRequestSecurityContext(request);
    final boolean isSecure = anonymousSecurityContext.isSecure();
    final Set<String> roles = AdapterUtils.getRolesFromSecurityContext(skSession);
    SecurityContext ctx = new SecurityContext() {

        @Override
        public Principal getUserPrincipal() {
            return principal;
        }

        @Override
        public boolean isUserInRole(String role) {
            return roles.contains(role);
        }

        @Override
        public boolean isSecure() {
            return isSecure;
        }

        @Override
        public String getAuthenticationScheme() {
            return "OAUTH_BEARER";
        }
    };
    request.setSecurityContext(ctx);
}